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DETAILED ACTION 

1. Claims 1-14 and 16-40 have been examined. 

Claim Objections 

2. Claim 12 objected to because of the following informalities: "obtained 
by the user off" should be changed to "obtained by the user off-line". 
Appropriate correction is required. 

Claim Rejections - 35 USC §101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

4. Claims 1-7 are rejected under 35 U.S.C. 101 because they are not 
directed to a practical application. A practical application would be 
established by a useful, concrete and tangible result. The claims are 
directed to a method for verifying the validity of an encrypted code 
corresponding to figure 16 and associated text in the specification. Figure 
16 shows a 7-step verification method; however, the claims recite only the 
first two steps (i.e., converting the base-L string to a base-2 string and 
decrypting the base-2 string), and are, therefore, considered an incomplete 
method. An incomplete method is not a useful method. 
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5. Claims 29 and 31-33 are rejected under 35 U.S.C. 101 because they 
are not directed to a practical application. A practical application would be 
established by a useful, concrete and tangible result. For a claim to provide 
a tangible result, it must be more than just a thought or a computation. 
Instead, it must have real world value rather than being an abstract result. 
With respect to claim 29, the claim is directed to a method comprising two 
steps: receiving a code and processing the code; however, since the result 
of the processing step is not utilized, the method fails to provide a tangible 
result. Therefore, the claim is non-statutory under 35 U.S.C. 101. Claims 
that are not specifically addressed are rejected by virtue of their 
dependency. 

Claim Rejections - 35 USC §112 

6. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and 
distinctly claiming the subject matter which the applicant regards as his invention. 

7. Claims 1-7, 29, 31-37 are rejected under 35 U.S.C. 112, second 
paragraph, as being incomplete for omitting essential steps, such omission 
amounting to a gap between the steps. See MPEP § 2172.01. 

■ Claim 1 is directed to a method for verifying the validity of an 

encrypted code corresponding to figure 16 and associated text in the 
specification. Figure 16 shows a 7-step verification method; however, 
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the claim recites only the first two steps (i.e., converting the base-L 
string to a base-2 string and decrypting the base-2 string). The 
omitted steps are the last five steps of figure 16. Claims that are not 
specifically addressed are rejected by virtue of their dependency. 
■ Claims 29 and 34 are directed to a method for offline-online 
.management of incentive points (the preamble); however, they do not 
recite any step(s) for managing incentive points. Claims that are not 
specifically addressed are rejected by virtue of their dependency. 



Claim Rejections - 35 USC §102 

8. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in 
this Office action: 

A person shall be entitled to a patent unless - 

(e) the Invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for 
patent or (2) a patent granted on an application for patent by another filed in the United 
States before the invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351(a) shall have the effects for 
purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 
21(2) of such treaty in the English language. 

9. Claim 17 is rejected under 35 U.S.C. 102(e) as being anticipated by 
Leason et al. (6,251,017). Leason discloses a system comprises: a main 
server (fig. 3, element 302) configured for providing a user with an interface 
for receiving a code from a user, wherein the code is obtainable by the user 
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of off-line and is associated with N points, wherein each point, characterized 
as a purchase incentive point, is redeemable and maintainable in an account 
for the user; and a code server (fig. 3, element 308) configured for 
maintaining valid codes and verifying, against the valid codes, the validity of 
the code received from the user, wherein the account has a balance of 
points capable of growing is valid such that a balance in the account for the 
user is increased by a predetermined number of points if the code is valid 
(Abstract; figures 3, 5-6, 11-12; col. 2, line 63 - col. 3, line 7; col. 5, lines 
41-53; col. 7. line 7 - col. 8, line 55). 



Claim Rejections - 35 USC §103 

10. The following is a quotation of 35 U.S.C. 103(a) which forms the basis 
for all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a 
whole would have been obvious at the time the invention was made to a person having 
ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 



11. Claims 1, 5-7, 34 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Beach et al. (5,892,827) in view of Schneier ("Applied 
Cryptography"). Beach discloses a method for generating an authorization 
code, i.e., a PIN, to be printed on a coupon/award certificate and validating 
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the authorization code when it is redeemed by a user (Abstract; col. 11, line 
12 - col. 12, line 13). 

Regarding claims 1, 5 and 34, Beach discloses a method for verifying 
the validity of an encrypted generated in base L = 10 (10 digits from 0-9) 
comprising: obtaining an encrypted code fashioned as a base 10 string 
derived from an n-bit raw number by producing a first string through 
application of a checksum function to the n-bit raw number, designating an 
m-bit portion of the first string as an m-bit validation number, i.e., the check 
digit, producing a second string through combination of the m-bit validation 
number and the n-bit raw number, producing a third string through 
application of an encryption algorithm to the second string with a secret key, 
and converting the third string to the base L string; converting the base 10 
string to a base 2 string (computers only recognize 0s and Is); decrypting 
the base 2 string; and verifying the validity of the encrypted code by 
processing the decrypted base 2 string (fig. 3; col. 6, line 56 - col. 8, line 
32). Beach discloses using a checksum function to generate the validation 
number. Beach does not disclose using a one-way hash function with a first 
secret key. Schneier discloses using a one-way hash function with a first 
secret key to generate a validation number, i.e., a MAC code (pages 30-31). 
It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify Beach method to use a one-way hash function 
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with a first secret key to generate the validation number, as taught by 
Schneier. The motivation for doing so would have been that: (i) given a 
hash value, it would be computationally unfeasible to find a pre-image that 
hashes to that value (page 30, last paragraph); and (ii) only someone with 
the secret key could verify the hash value (page 31, 2nd paragraph). 

Regarding claims 6-7, Beach discloses that m is the least significant bit 
(LSB) portion of the first/second string. Beach does not disclose that m is 
the most significant bit (MSB) portion of the first/second string. At the time 
the invention was made, it would have been obvious to one of ordinary skill 
in the art to modify the encrypted code of Beach such that m is the most 
significant bit (MSB) portion of the first/second string. Applicant has not 
disclosed that assigning m to be the MSB portion of the first/second string 
provides an advantage, is used for a particular purpose, or solves a stated 
problem. One of ordinary skill in the art, furthermore, would have expected 
Applicant's invention to perform equally well with m being the least 
significant bit (LSB) portion of the first/second string as disclosed in the prior 
art because they serve the same purpose and one is just the alternative to 
the other. Therefore, it would have been obvious to one of ordinary skill in 
the art to modify Beach to obtain the invention as specified in claims 6-7. 
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12. Claims 2 and 10-11 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Beach in view of Schneier as applied to claim 1 above, 
and further in view of 'TIPS PUB 46-3 - Data Encryption Standard (DES)" 
(hereinafter TIPS 46-3"). 

Regarding claims 2 and 10, Beach discloses encrypting and decrypting 
the code (fig. 3, step 50). Beach does not disclose using the DES3 
algorithm. TIPS 46-3" discloses using the DES3 algorithm, i.e., Triple DES 
algorithm (Section 15 - Qualifications). It would have been obvious to one 
of ordinary skill in the art at the time the invention was made to modify the 
combined method of Beach and Schneier to use the DES3 algorithm for 
encryption and decryption, as taught in TIPS 46-3", in order to increase 
data security (page 5, last paragraph). 

Regarding claim 11, Beach discloses that m is the least significant bit 
(LSB) portion of the first/second string. Beach does not disclose that m is 
the most significant bit (MSB) portion of the first/second string. At the time 
the invention was made, it would have been obvious to one of ordinary skill 
in the art to modify the encrypted code of Beach such that m is the most 
significant bit (MSB) portion of the first/second string. Applicant has not 
disclosed that assigning m to be the MSB portion of the first/second string 
provides an advantage, is used for a particular purpose, or solves a stated 
problem. One of ordinary skill in the art, furthermore, would have expected 
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Applicant's invention to perform equally well with m being the least 
significant bit (LSB) portion of the first/second string as disclosed in the prior 
art because they serve the same purpose and one is just the alternative to 
the other. Therefore, it would have been obvious to one of ordinary skill in 
the art to modify Beach to obtain the invention as specified in claim 11. 

13. Claim 4 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Beach in view of Schneier as applied to claim 1 above, and further in view of 
Krawczyk et al., "RFC 2104 - HMAC: Keyed-Hashing for Message 
Authentication". Schneier discloses using a keyed-hash function. Schneier 
does not disclose using MD5 algorithm for the keyed-hash function. 
Krawczyk discloses a keyed-hash function that uses MD5 algorithm (page 2, 
1 st paragraph; page 6, 5 th paragraph). It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to modify the 
combined method of Beach and Schneier to use the one-way hash function 
MD5, as taught by Krawczyk. The motivation for doing so would have been 
that MD5 is one of the hash functions that perform well in software and for 
which code is freely and widely available (page 2, 1 st paragraph). 
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14. Claims 35-36 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Beach in view of Schneier as applied to claim 34 above, 
and further in view of "FIPS 46-3" and Krawczyk. 

Beach discloses encrypting and decrypting the code (fig. 3, step 50). 
Beach does not disclose using the DES3 algorithm. "FIPS 46-3" discloses 
using the DES3 algorithm, i.e., Triple DES algorithm and 128-bit keys 
(Section 15 - Qualifications). It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to modify the combined 
method of Beach and Schneier to use the DES3 algorithm for encryption and 
decryption, as taught in "FIPS 46-3", in order to increase data security (page 
5, last paragraph). 

Schneier discloses using a keyed-hash function. Schneier does not 
disclose using MD5 algorithm and a 128-bit key for the keyed-hash function. 
Krawczyk discloses a keyed-hash function that uses MD5 algorithm and a 
128-bit key (page 2, 1 st paragraph; page 6, 5 th paragraph; page 8). It 
would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the combined method of Beach and Schneier 
to use MD5 algorithm and a 128-bit key for the keyed-hash function, as 
taught by Krawczyk. The motivation for doing so would have been that MD5 
is one of the hash functions that perform well in software and for which code 
is freely and widely available (page 2, 1 st paragraph). 
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15. Claims 8, 12, 18-20, 29-32 rejected under 35 U.S.C. 103(a) as being 
unpatentable over Leason in view of Beach. 

Regarding claims 8, 12, 18-20 and 29-32, Leason discloses a method 
for verifying the validity of a code obtained by a user from an object, 
comprising the steps of: receiving the code on-line from the user, the code is 
generated as a base L string and obtained by the user off-line from the 
object; converting the base L string to a base 2 string; verifying the validity 
of the code by processing the base 2 string; and awarding incentive points 
to the user if the code is valid (figures 3, 5-6, 11-12; col. 2, line 63 - col. 3, 
line 7; col. 5, lines 41-53; col. 6, lines 1-11). Leason does not explicitly 
disclose that the code is generated by providing a number portion, deriving a 
validation portion from the number portion, appending the validation portion 
to the number portion to form a string, encrypting the string, and deriving 
the code from the encrypted string by converting the encrypted string to 
base L string. However, Leason discloses utilizing a method taught by Beach 
for generating and verifying a validation code as claimed (Leason: col. 12, 
lines 9-15; Beach: fig. 3; col. 6, line 56 - col. 8, line 32). It would have 
been obvious to one of ordinary skill in the art at the time the invention was 
made to incorporate Beach method into Leason. The motivation for doing so 
would have been to generate validation codes that are fraud resistant and 
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without the need for a pre-approved database of valid validation codes (col. 
5, lines 8-11). 

16. Claims 9, 13-14, 16, 22 and 38 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Leason in view of Beach as applied to claims 8, 12 
and 30 above, and further in view of Schneier and "FIPS 46-3". Beach 
discloses using a checksum function to generate the validation number. 
Beach does not disclose using a one-way hash function with a first secret 
key. Schneier discloses using a one-way hash function with a first secret 
key to generate a validation number, i.e., a MAC code (pages 30-31). It 
would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the combined method of Leason and Beach to 
use a one-way hash function with a first secret key to generate the 
validation number, as taught by Schneier. The motivation for doing so 
would have been that: (i) given a hash value, it would be computationally 
unfeasible to find a pre-image that hashes to that value (page 30, last 
paragraph); and (ii) only someone with the secret key could verify the hash 
value (page 31, 2nd paragraph). Beach discloses encrypting and decrypting 
the code (fig. 3, step 50). Beach does not disclose using the DES3 
algorithm. "FIPS 46-3" discloses using the DES3 algorithm, i.e., Triple DES 
algorithm and 128-bit keys (Section 15 - Qualifications). It would have 
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been obvious to one of ordinary skill in the art at the time the invention was 
made to further modify the combined method of Leason and Beach to use 
the DES3 algorithm for encryption and decryption, as taught in "FIPS 46-3", 
in order to increase data security (page 5, last paragraph). 

Regarding claim 16, Beach discloses that m is the least significant bit 
(LSB) portion of the first/second string. Beach does not disclose that m is 
the most significant bit (MSB) portion of the first/second string. At the time 
the invention was made, it would have been obvious to one of ordinary skill 
in the art to modify the encrypted code of Beach such that m is the most 
significant bit (MSB) portion of the first/second string. Applicant has not 
disclosed that assigning m to be the MSB portion of the first/second string 
provides an advantage, is used for a particular purpose, or solves a stated 
problem. One of ordinary skill in the art, furthermore, would have expected 
Applicant's invention to perform equally well with m being the least 
significant bit (LSB) portion of the first/second string as disclosed in the prior 
art because they serve the same purpose and one is just the alternative to 
the other. Therefore, it would have been obvious to one of ordinary skill in 
the art to modify Beach to obtain the invention as specified in claim 16. 

17. Claims 23-24 and 39-40 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Leason, Beach, Schneier and "FIPS 46-3" as applied to 
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claim 22 above, and further in view of Krawczyk. Schneier discloses using a 
keyed-hash function. Schneier does not disclose using MD5 algorithm and a 
128-bit key for the keyed-hash function. Krawczyk discloses a keyed-hash 
function that uses MD5 algorithm and a 128-bit key (page 2, 1 st paragraph; 
page 6, 5 th paragraph; page 8). It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to modify the 
combined method of Leason, Beach, Schneier and TIPS 46-3" to use MD5 
algorithm and a 128-bit key for the keyed-hash function, as taught by 
Krawczyk. The motivation for doing so would have been that MD5 one of 
the hash functions that perform well in software and for which code is freely 
and widely available (page 2, 1 st paragraph). 

18. Claim 26 is rejected under 35 U.S.C. 103(a) as being unpatentable 
over Leason as applied to claim 17 above, and further in view of Beach and 
Schneier. Leason does not explicitly disclose that the code server includes: 
means for converting the submitted code from a base L string into a base 2 
string S4; means for decrypting S4 using a second secret key, K2, to form a 
decrypted first string, SI'; means for providing a number portion, INT, from 
SI'; means for arranging a first secret key, Kl, next to the number portion 
INT, to form a second string, S2'; means for applying a hash function to S2' 
to form a third string S3'; means for extracting a validation portion from S3 1 
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and a validation portion from SI'; and means for determining if the code is 
valid by comparing the validation portion from S3' with the validation portion 
from SI'. Beach discloses a system for generating and verifying a validation 
code wherein, for verifying the validation code, the system comprises: 
means for converting the submitted validation code from a base L string into 
a base 2 string S4; means for decrypting S4 using a secret key K, to form a 
decrypted first string, SI'; means for providing a number portion, INT, from 
SI'; means for applying a checksum function to INT to form a string S3'; 
means for extracting a validation portion from S3' and a validation portion 
from SI'; and means for determining if the code is valid by comparing the 
validation portion from S3' with the validation portion from SI' (fig. 3; col. 
6, line 56 - col. 8, line 32). It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to incorporate Beach 
system for generating and verifying a validation code into Leason. The 
motivation for doing so would have been to generate validation codes that 
are fraud resistant and without the need for a pre-approved database of 
valid validation codes (col. 5, lines 8-11). Beach discloses using a checksum 
function to generate the validation number. Beach does not disclose using a 
one-way hash function with a first secret key. Schneier discloses applying a 
one-way hash function to data concatenated with a secret key to generate a 
validation number, i.e., a MAC code (pages 30-31). It would have been 
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obvious to one of ordinary skill in the art at the time the invention was made 
to further modify Leason system to include means for applying a one-way 
hash function to data concatenated with a secret key to generate a 
validation number, as taught by Schneier. The motivation for doing so 
would have been that: (i) given a hash value, it would be computationally 
unfeasible to find a pre-image that hashes to that value (page 30, last 
paragraph); and (ii) only someone with the secret key could verify the hash 
value (page 31, 2nd paragraph). 

19. Claims 27-28 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Leason in view of Beach and Schneier as applied to claim 
26 above, and further in view of "FIPS 46-3" and Krawczyk. 

Beach discloses encrypting and decrypting the code (fig. 3, step 50). 
Beach does not disclose using the DES3 algorithm. "FIPS 46-3" discloses 
using the DES3 algorithm, i.e., Triple DES algorithm and 128-bit keys 
(Section 15 - Qualifications). It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to modify the combined 
method of Leason, Beach and Schneier to use the DES3 algorithm for 
encryption and decryption, as taught in "FIPS 46-3", in order to increase 
data security (page 5, last paragraph). 
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Schneier discloses using a keyed-hash function. Schneier does not 
disclose using MD5 algorithm and a 128-bit key for the keyed-hash function. 
Krawczyk discloses a keyed-hash function that uses MD5 algorithm and a 
128-bit key (page 2, 1 st paragraph; page 6, 5 th paragraph; page 8). It 
would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the combined method of Leason, Beach and 
Schneier to use MD5 algorithm and a 128-bit key for the keyed-hash 
function, as taught by Krawczyk. The motivation for doing so would have 
been that MD5 one of the hash functions that perform well in software and 
for which code is freely and widely available (page 2, 1 st paragraph). 

Leason and Beach disclose that the code is 80-bit long (i.e., 10 
alphanumeric characters x 8 bits/character). Leason and Beach do not 
disclose that the code is 48-bit long. However, one of ordinary skill in the art 
would know that choosing the length for such a code is a tradeoff between 
code availability (i.e., the longer the code, the more code combinations are 
available) and system performance (i.e., higher computational/processing 
cost for longer codes). Since the length of the code could be varied 
according to the requirements of each system, it would have been obvious to 
one of ordinary skill in the art at the time the invention was made to modify 
the combined method of Leason, Beach and Schneier such that the length of 
the code is 48 bits in order to meet the requirements of a certain system. 
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Allowable Subject Matter 

20. Claims 3 and 33 would be allowable if rewritten to overcome the 
rejection(s) under 35 U.S.C. 101 and 112, 2nd paragraph, set forth in this 
Office action and to include all of the limitations of the base claim and any 
intervening claims. 

21. Claims 21 and 25 are objected to as being dependent upon a rejected 
base claim, but would be allowable if rewritten in independent form including 
all of the limitations of the base claim and any intervening claims. 

22. Claim 37 would be allowable if rewritten to overcome the rejection(s) 
under 35 U.S.C. 112, 2nd paragraph, set forth in this Office action and to 
include all of the limitations of the base claim and any intervening claims. 

23. The following is a statement of reasons for the indication of allowable 
subject matter. Regarding claims 3, 21, 25, 33 and 37, a 48-bit code 
comprising a 32-bit number and a 16-bit validation number, in combination 
with elements of the parent claims, has not been taught by prior art. 
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Conclusion 

24. The prior art made of record and not relied upon is considered 
pertinent to applicant's disclosure. 

U.S. Patent No. 5,791,990 to Schroeder et al. 

U.S. Patent No. 6,110,044 to Stern 

U.S. Patent No. 6,766,301 to Daniel et al. 

U.S. Patent No. 6,987,853 to Uner 

U.S. Patent No. 7,013,286 to Aggarwal et al. 

U.S. Patent App. Publication No. 2002/0010627 to Lerat 

U.S. Patent App. Publication No. 2002/0016737 to Izzo et al. 

Any inquiry concerning this communication or earlier communications 
from the examiner should be directed to Minh Dinh whose telephone number 
is 571-272-3802. The examiner can normally be reached on Mon-Fri: 
10:00am-6:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Gilberto Barron can be reached on 571-272-3799. 
The fax phone number for the organization where this application or 
proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained 
from the Patent Application Information Retrieval (PAIR) system. Status 
information for published applications may be obtained from either Private 
PAIR or Public PAIR. Status information for unpublished applications is 
available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center 
(EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272- 



1000. 



Minh Dinh 
Examiner 
Art Unit 2132 
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